NIST gives up enriching most CVEs

NIST announced it will restrict CVE enrichment efforts to three categories: actively exploited vulnerabilities in CISA's KEV database, vulnerabilities in federal agency software, and designated critical software including operating systems, browsers, security software, and VPNs. The shift reflects resource constraints after two years of struggling to keep pace with the explosion in vulnerability discoveries. Most CVE entries will no longer receive detailed enrichment data.